1 – Your Practice, Fitstuff Clinic, based at Chapel Street, Guildford, which hereafter for the purposes of this Privacy Notice will be referred to as the Fitstuff Clinic, is pleased to provide the following information:
2 – Who we are
Fitstuff Clinic provides assessment, treatment and health care services through a team of qualified practitioners. Treatments are carried out in accordance with each practitioner’s professional standards, regulatory requirements and professional codes of practice. Osteopathic treatment is carried out in accordance with the Institute of Osteopathy’s patient charter http://www.iosteopathy.org/osteopathy/the-patient-charter/. Physiotherapy treatment is carried out in accordance with the standards and guidance set by the Chartered Society of Physiotherapy (CSP) and, where applicable, the Health and Care Professions Council (HCPC).
The practice may also provide other treatments, about which our staff will be pleased to provide more details.
Fitstuff Clinic is the Data Controller for the personal information that we process about our patients. This means we are responsible for deciding how your personal data is collected, stored, used and protected in accordance with UK GDPR and the Data Protection Act 2018.
3 – Personal Data
For the purposes of providing treatment, Fitstuff Clinic may require detailed medical information. We will only collect what is relevant and necessary for your treatment.
When you visit our practice, we will make notes which may include details concerning your health, medical history, medication, examination findings, treatment, advice given and other issues affecting your health. This data is always held securely and is not shared with anyone not involved in your treatment, although for data storage and administrative purposes it may be handled by pre-vetted staff and service providers who are subject to appropriate confidentiality and data protection obligations.
To be able to provide safe and effective healthcare, Fitstuff Clinic is required to document and process your personal medical data. We process this information where it is necessary for the provision of healthcare services and the management of your treatment records, in accordance with UK GDPR requirements relating to health data.
Contact details provided by you such as telephone numbers, email addresses and postal addresses may be used to remind you of future appointments and provide reports or other information concerning your treatment.
As part of our obligations as healthcare practitioners, there may be circumstances related to your treatment, ongoing care or medical diagnosis that require the sharing of your medical records with other healthcare practitioners e.g. GPs, consultants, surgeons and/or medical insurance companies. Where this is required we will inform you first unless we are required or permitted by law to share information.
For marketing purposes, Fitstuff Clinic may also use the contact details provided by you to respond to your enquiries and, where permitted, provide information to you which the practice believes may be of interest to you. We will only send marketing communications where we have a lawful basis to do so and you can ask us to stop sending marketing communications at any time.
Fitstuff Clinic may occasionally also act on behalf of its patients in the capacity of data processor when we may promote or provide information relating to other practitioners based at our premises who may not be employed by us. Fitstuff Clinic does not sell or broker your data and you can ask to be removed from our marketing database by emailing or phoning the practice using the contact details provided at the end of this Privacy Notice.
Some basic personal data may be collected about you from enquiry forms, marketing forms and surveys you complete, from records of our correspondence and phone calls and details of your visits to our website, which may include information such as Internet Protocol (IP) addresses.
Fitstuff Clinic’s website may use cookies, which are small files stored on a visitor’s device to help websites operate and understand visitor preferences. Some cookies are necessary for the operation of the website, while other optional cookies such as analytics or marketing cookies will only be used where appropriate consent has been provided. Visitors can manage cookie preferences through the website cookie settings and their browser settings.
Fitstuff Clinic will only collect the information needed so that we can provide you with the services you require. The business does not sell or broker your data.
4 – Legal basis for processing any personal data
Fitstuff Clinic processes personal data under the lawful bases set out within UK GDPR. This may include processing that is necessary for the provision of healthcare services, performance of a contract, compliance with legal obligations and legitimate interests such as responding to enquiries concerning the services provided.
Where we process special category data, including health information, we do so where necessary for the provision of healthcare or treatment by a healthcare professional and the management of healthcare records.
Where consent is the appropriate lawful basis, such as certain marketing activities, consent can be withdrawn at any time.
5 – Legitimate interests pursued by Fitstuff Clinic
To provide information about treatments and services for patients with health problems indicated for osteopathic care, to respond to patient enquiries, to manage the practice effectively and to maintain appropriate communication with patients.
We will only rely on legitimate interests where those interests are not overridden by your data protection rights and freedoms.
6 – Consent
Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time by using the postal address, email address or telephone number provided at the end of this Privacy Notice.
Withdrawal of consent will not affect processing already carried out before withdrawal. Please note that some healthcare records may need to be retained where required for legal, professional, regulatory or insurance purposes.
7 – Disclosure
Fitstuff Clinic will keep your personal information safe and secure. Only practitioners and staff involved in providing or supporting your treatment will have access to information necessary for their role. Patient records will only be accessed where required for treatment, administration, practice management or other legitimate purposes connected with your care.
Our administration team will have access to your contact details so that they can make appointments and manage your account.
Fitstuff Clinic will not disclose your Personal Information unless it is necessary for your treatment, you have requested us to do so, or we are required or permitted to meet legal obligations, regulations, professional requirements or valid governmental requests.
The practice may also process information where necessary to enforce its Terms and Conditions, including investigating potential violations of its Terms and Conditions, detecting, preventing or mitigating fraud, security or technical issues, or protecting against harm to the rights, property or safety of its patients, staff or others.
8 – Retention Policy
Fitstuff Clinic will process personal data during the duration of any treatment and will continue to store only the personal data needed after treatment has ended to meet legal, professional, regulatory and insurance obligations.
Adult patient healthcare records will normally be retained for a minimum of eight years following the last treatment or contact with the practice, unless a longer retention period is required.
Records concerning minors who have received treatment will normally be retained until the patient has reached the age of 25, or for eight years after the last treatment where this is longer.
After the required retention period has passed, records will be securely deleted or destroyed unless basic information needs to be retained by us to meet our future obligations to you or comply with legal requirements.
9 – Data storage
Patient records are stored securely using Cliniko, a cloud-based practice management solution located in Australia.
Cliniko acts as a data processor on behalf of the practice and appropriate contractual and security arrangements are in place to protect patient data and data subject rights in accordance with UK GDPR.
Where personal data is transferred outside the United Kingdom, Fitstuff Clinic will ensure appropriate safeguards are in place as required by UK GDPR, such as recognised contractual protections or other lawful transfer mechanisms.
10 – Your rights as a data subject
At any point whilst Fitstuff Clinic is in possession of, or processing your personal data, all data subjects have the following rights:
- Right of access – you have the right to request a copy of the information that we hold about you.
- Right of rectification – you have the right to correct data that we hold about you that is inaccurate or incomplete.
- Right to erasure – in certain circumstances you can ask for the data we hold about you to be erased from our records.
- Right to restriction of processing – where certain conditions apply you have the right to restrict the processing of your personal data.
- Right of portability – where applicable, you have the right to have the data we hold about you transferred to another organisation.
- Right to object – you have the right to object to certain types of processing such as direct marketing.
- Right relating to automated decision making, including profiling – you have the right not to be subject to decisions based solely on automated processing where these have a legal or similarly significant effect.
Please note that some rights may not apply in all circumstances, particularly where healthcare records must be retained to comply with legal, professional or regulatory obligations.
If Fitstuff Clinic is unable to comply with your request, we will explain the reason why and advise you of your rights.
At your request Fitstuff Clinic can confirm what information it holds about you and how it is processed.
11 – You can request the following information:
- Identity and contact details of the person or organisation (Fitstuff Clinic) that has determined how and why to process your data.
- Contact details of the data protection officer, where applicable.
- The purpose of the processing as well as the legal basis for processing.
- If the processing is based on the legitimate interests of Fitstuff Clinic, information about those interests.
- The categories of personal data collected, stored and processed.
- Recipient(s) or categories of recipients that the data is or will be disclosed to.
- How long the data will be stored, or the criteria used to determine that period.
- Details of your rights to request correction, erasure, restriction of processing or objection to processing.
- Information about your right to withdraw consent where consent is the lawful basis for processing.
- How to lodge a complaint with the supervisory authority (ICO).
- Whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, whether you are obliged to provide the personal data and the possible consequences of failing to provide such data.
- The source of personal data if it was not collected directly from you.
- Any details and information relating to automated decision making, such as profiling, including meaningful information about the logic involved and the significance and expected consequences of such processing.
12 – To access what personal data is held, identification may be required
Fitstuff Clinic may request appropriate identification when information on your personal data is requested, where this is necessary to confirm your identity and protect your information.
Identification requested will be proportionate to the nature of the request and the information being provided. Examples of identification may include a driving licence, passport, birth certificate, utility bill or other suitable evidence of identity.
If Fitstuff Clinic is unable to verify your identity, further information may be requested before personal data can be released.
All requests should be made to:
Email: pl@fitstuffclinic.co.uk
Telephone: +44 (0) 1483 533133
or by writing to us at the address provided within this Privacy Notice.
13 – Complaints
In the event that you wish to make a complaint about how your personal data is being processed by Fitstuff Clinic, you have the right to complain to us using the contact details provided.
We will investigate your complaint and respond as soon as reasonably possible.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters.
ICO contact details:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Website: www.ico.org.uk